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DETAILED ACTION 

1 . This action is in response to the amendment filed March 31 , 2008. 

2. Claims 1,12, 14, 24, and 38 have been amended and new claim 39 has been 
added. 

3. Claims 1-16, 18-36, 38, and 39 have been examined and are pending with this 
action. 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

4. Claims 1-16, 18-36, 38, and 39 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Kao et al. (US 6,070,177) in view of Wong (US 7,127,448). 
INDEPENDENT: 

As per claim 1, Kao teaches an apparatus comprising an application program 
(see col. 3, line 67-col.4, line 3: "network client runs a 'web browser', which is simply an 
application program for accessing and providing...") comprising: 
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one or more business components, wherein a business component comprises 
one or more fields, wherein the fields correspond to records in a database, and the 
database is separate from the application program (see Fig. 3; col.1, lines 34-36: 
"database forms are often created to present the data corresponding to a specific 
activity"; and col .3, lines 14-15: "request and receive documents or database files 
comprising data or object descriptors"), 

means for selecting for auditing a business component from the one or more 
business components (see col. 10, lines 8-13: "creating an audit trail for a database form 
or document that is transmitted among users... a user selects a database form to use 
for a particular request"), 

means for selecting for auditing one or more selected operations of a plurality of 
operations, wherein the operations are configured to operate on the selected business 
component (see col. 5, lines 4-7: "consists of a number of fixed fields that indicate the 
type of data or information to be entered" and col.7, line 22-39), 

means for creating an audit trail for the application program (see col.4, lines 58- 
62: "stores data created for that program" and col. 5, lines 51-56: "information relating to 
each user is appended to the audit trail"), and 

means for providing the audit trail to the database associated with the fields of 
the business component (see col.4, lines 58-67: "Various types of data relating to 
different activities can be stored in a network server 104 by the database application"). 



Application/Control Number: 09/963,292 Page 4 

Art Unit: 2155 

Kao does not explicitly teach that the means for selecting for auditing one or 
more selected operations is further configured to exclude one or more operations of the 
plurality of operations from auditing. 

Wong teaches means for selecting for auditing one or more selected operations 
is further configured to exclude one or more operations of the plurality of operations 
from auditing (see col. 8, lines 20-30: "creating audit records only for selected rows in 
the relational database that are accessed by the database operation and that satisfy the 
auditing condition"). 

It would have been obvious to a person of ordinary skill in the art at the time the 
invention was made to modify the system of Kao in view of Wong so that means for 
selecting for auditing one or more selected operations is further configured to exclude 
one or more operations of the plurality of operations from auditing. One would be 
motivated to do so because such means saves processing time and power by only 
auditing requested operations and because such step is subjective. 

As per claim 14, Kao teaches a system comprising: 
a processor (see col. 3, lines 15-20: "CPU"); and 
a memory coupled to the processor and storing 

a first set of instructions, executable by the processor (see col .3, lines 26-28: 
"loaded into memory"), configured to provide a business component wherein the 
business component comprises one or more field, wherein the fields correspond to 
records in a database, and the database is separate from the application program (see 
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Fig. 3; col.1 , lines 34-36: "database forms are often created to present the data 
corresponding to a specific activity"; and col. 3, lines 14-15: "request and receive 
documents or database files comprising data or object descriptors"), 

a second set of instructions (see col. 3, lines 26-28: "instructions"), executable by 
the processor, configured to provide user interface (see col. 3, line 67-col.4, line 3: "web 
browser"), wherein the user interface is configured to allow selection for auditing of a 
selected field of the one or more fields and one or more selected operations on the 
selected fields (see col. 10, lines 8-13: "creating an audit trail for a database form or 
document that is transmitted among users... a user selects a database form to use for a 
particular request"), 

a third set of instructions (see col. 3, lines 26-28: "instructions"), executable by the 
processor, configured to detect when the selected operations are performed on the 
selected fields (see col. 6, lines 46-51 : "automatically entered by the client computer or 
server computer upon a specific event"), 

a fourth set of instructions (see col .3, lines 26-28: "instructions"), executable by 
the processor, configured to generate an audit transaction record regarding the selected 
field when the selected operations are detected (see col. 9, lines 21-24: "data in the 
audit trail con only be added or modified by specific actions related to the transmission 
of the request"), and 

a fifth set of instructions (see col. 3, lines 26-28: "instructions"), executable by the 
processor, configured to provide the audit transaction record to the database associated 
with the fields of the business component (see col.4, lines 58-67: "Various types of data 
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relating to different activities can be stored in a network server 104 by the database 
application"). 

Kao does not explicitly teach user interface further configured to allow selection 
for excluding from auditing one or more selected operations. 

Wong teaches user interface further configured to allow selection for excluding 
from auditing one or more selected operations (see col. 8, lines 20-30: "creating audit 
records only for selected rows in the relational database that are accessed by the 
database operation and that satisfy the auditing condition"). 

It would have been obvious to a person of ordinary skill in the art at the time the 
invention was made to modify the system of Kao in view of Wong by implementing user 
interface further configured to allow selection for excluding from auditing one or more 
selected operations. One would be motivated to do so because such means saves 
processing time and power by only auditing requested operations and because such 
step is subjective. 

As per claim 24, Kao teaches a method comprising: 

auditing an application program wherein said auditing comprises creating an 
audit trail (see col.4, lines 58-62: "stores data created for that program" and col. 5, lines 
51-56: "information relating to each user is appended to the audit trail"); 

using the application program (see col. 3, line 67-col.4, line 3: "network client runs 
a 'web browser', which is simply an application program for accessing and providing...") 
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to perform audit trail functions (see col. 2, lines 63-64: "associating an audit trail with a 
database form is disclosed") comprising: 

generating a list of business components included in the application program, 
wherein a business component of the list of business components comprises one or 
more fields, wherein the fields correspond to records in a database, and the database is 
separate from the application program (see Fig.3; col.1 , lines 34-36: "database forms 
are often created to present the data corresponding to a specific activity"; and col. 3, 
lines 14-15: "request and receive documents or database files comprising data or object 
descriptors"), 

presenting the list of business components to a user (see Fig.3 and Fig.4); 

allowing the user to select for auditing a selected business component (see 
col. 10, lines 8-13: "creating an audit trail for a database form or document that is 
transmitted among users... a user selects a database form to use for a particular 
request"); 

presenting the list of operations that can be performed on the selected business 
component to the user (see Fig.4 and Fig.5); 

allowing the user to select for auditing one or more selected operations for the 
selected business component (see col. 5, lines 4-7: "consists of a number of fixed fields 
that indicate the type of data or information to be entered" and col. 7, line 22-39), and 

providing the audit trail to the database associated with the fields of the business 
component (see col.4, lines 58-67: "Various types of data relating to different activities 
can be stored in a network server 104 by the database application"). 
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Kao does not explicitly teach allowing the user to exclude from auditing one or 
more selected operations for the selected business component. 

Wong teaches allowing the user to exclude from auditing one or more selected 
operations for the selected business component (see col. 8, lines 20-30: "creating audit 
records only for selected rows in the relational database that are accessed by the 
database operation and that satisfy the auditing condition"). 

It would have been obvious to a person of ordinary skill in the art at the time the 
invention was made to modify the system of Kao in view of Wong by implementing 
allowing the user to exclude from auditing one or more selected operations for the 
selected business component. One would be motivated to do so because such means 
saves processing time and power by only auditing requested operations and because 
such step is subjective. 

DEPENDENT: 

As per claim 2, which depends on claim 1 , Kao further teaches wherein the 
application program further comprises: means for detecting when the selected 
operations are performed (see col. 6, lines 46-51 : "automatically entered by the client 
computer or server computer upon a specific event"). 

As per claim 3, which depends on claim 2, Kao further teaches wherein the 
application program further comprises: means for generating an audit transaction record 
regarding the business component when the selected operations are detected (see 
col. 5, lines 51-56: "information relating to each user is appended to the audit trail"). 
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As per claim 4, 15, and 25, which depend on claims 1,14, and 24, respectively, 
Kao further teaches wherein the selected or list of operations to be audited include at 
least one of: update, add, copy, and delete (see col. 5, lines 11-13: "modify the data 
within the form"). 

As per claim 5, 16, and 26, which depend on claims 1, 14, and 24, respectively, 
Kao teaches of further comprising means for allowing the user to restrict access to the 
audit trail by at least one of: an employee identifier, an employment position, and an 
area of responsibility (see col. 5, lines 29-33: "authorized to make changes"; col. 6, lines 
19-22; and col. 7, lines 42-44: "employee to a supervisor or personnel department"). 

As per claim 6 and 28, which depend on claims 3, 14, and 27, respectively, Kao 
does not explicitly teach of further comprising means for storing the audit transaction 
record in an external database. 

Wong teaches storing the audit transaction record in an external database (see 
Fig.1 and col. 2, lines 9-10: "The system records the audit record in an audit record 
store"). 

It would have been obvious to a person of ordinary skill in the art at the time the 
invention was made to modify the system of Kao in view of Wong by implementing 
storing the audit transaction record in an external database. One would be motivated to 
do so because Kao teaches that the network of the invention comprises the World Wide 
Web, which clearly consists of internal and external databases, and because the 
storage locale of any data is subjective. 
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As per claims 7, 18, and 29, which depend on claims 3, 14, and 27, respectively, 
Kao teaches of further comprising means for storing the audit transaction record in a file 
(see col.4, lines 47-50: "that create and store files and data"). 

As per claims 8, 19, and 30, which depend on claims 7, 18, and 29, respectively, 
Kao further teaches wherein the means for providing the audit trail comprises means for 
importing the audit transaction record stored in the file to the database (see col.4, lines 
58-67: "The data can be entered into the server computer directly or into a client 
computer coupled to the server over a network"). 

As per claims 9, 20, and 31, which depend on claims 3, 14, and 27, respectively, 
Kao further teaches wherein the audit transaction record includes at least one of: an 
identifier for the entity that accessed the business component or the field, the operation 
that was performed on the business component, when the operation was performed, a 
previous value of the field, a current value of the field, and how the value of at least a 
portion of the business component was changed (see col. 5, lines 40-44: "lists such 
information as the name or ID of the user who created the form, the names or ID's of 
each of the users who received the form, the data and time of reception, any action 
taken by each user, and other such information"). 

As per claims 10, 21, and 32, which depend on claims 3, 14, and 27, 
respectively, Kao teaches of further comprising means for allowing the user to query 
one or more of the audit transaction records (see col. 5, lines 40-48: "provides a means 
by which the transmission history and actions taken regarding a particular document, 
set of data, or database form may be viewed by the users of the document or form"). 
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As per claims 11, 23, and 33, which depend on claim 2, 14, and 27, 
respectively, Kao teaches of further comprising means for prompting the user to enter a 
comment or a description of the operation when the selected operations are detected 
(see col. 6, lines 53-56: "Other fields in the audit trail may be text entry fields that allow a 
user to type information directly into the audit trail"). 

As per claims 12 and 34, which depend on claims 1 and 24, respectively, Kao 
further teaches wherein the one or more selected business components comprise a 
plurality of fields, and further comprising: means for selecting a selected filed of the 
plurality of fields to be audited (see col. 7, lines 22-24: "make changes or revisions to the 
contents of a form"; and col. 10, lines 8-13: "a user selects a database form to use for a 
particular request"), wherein the means for selecting a selected filed is further 
configured to exclude one or more fields of the plurality of fields from auditing (see claim 
1 and 24 rejections above); and means for generating an audit transaction record when 
one of the selected operations on one of the selected fields is detected (see col. 6, lines 
46-51 : "automatically entered by the client computer or server computer upon a specific 
event"). 

As per claims 13, 22 and 35, which depend on claims 1, 14, and 34, 
respectively, Kao teaches of further comprising means for allowing the user to restore 
the one or more of the fields to a previous state or value (see col. 8, lines 48-55: "return 
the request back"). 

As per claim 27, which depend on claim 24, Kao teaches of further comprising: 
detecting when the selected operations are performed on one of the selected business 
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components (see col. 6, lines 46-51 : "automatically entered by the client computer or 
server computer upon a specific event"); and generating an audit transaction record 
when the selected operations are detected (see col. 9, lines 21-24: "data in the audit trail 
con only be added or modified by specific actions related to the transmission of the 
request"). 

As per claim 36, which depend on claim 24, Kao further teach of a computer- 
readable storage medium comprising: instructions for implementing the method of claim 
24 (see col. 3, lines 26-50: "instructions"). 

As per claim 38, which depends on claim 1 , Kao further teaches wherein the 
application further comprises means for selecting the audit trail, where the audit trail is 
configured to be selected repetitively; means for enabling the audit trail, subsequent to 
selecting the audit trail, where the audit trail is configured to be enabled repetitively; and 
means for disabling the audit trail, subsequent to selecting the audit trail, where the 
audit trail is configured to be disabled repetitively (implicit: see col. 6, lines 46-64). 

As per claim 39, which depends on claim 1 , Kao does not explicitly teach the 
business component comprises a table which includes information for item, person, or 
other entity. 

Wong teaches comprising a table (see col. 2, lines 7-9). 

It would have been obvious to a person of ordinary skill in the art at the time the 
invention was made to modify the system of Kao in view of Wong so that business 
component comprises a table. One would be motivated to do so because such 
limitation is subjective to merely suggest a display preference. 
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Kao and Wong do not explicitly teach that the table includes information for item, 
person, or other entity. 

However these differences are only found in the nonfunctional descriptive 
material and are not functionally involved in the steps recited. The display of a table will 
be presented regardless of the data. Thus this descriptive material will not distinguish 
the claimed invention from the prior art in terms of patentability, see In re Gulack, 703 
F.2d 1 381 , 1 385, 217 USPQ 401 , 404 (Fed. Cir. 1 983); In re Lowry, 32 F.3d 1 579, 32 
USPQ2d 1031 (Fed. Cir. 1994). 

Therefore, it would have been obvious to a person of ordinary skill in the art at 
the time the invention was made to employ and heading within the business component 
table because such data does not functionally relate to the steps in the method claimed 
and because the subjective interpretation of the data does not patentably distinguish the 
claimed invention. 

Response to Arguments 

5. Applicant's arguments with respect to claims 1-16, 18-36, 38, and 39 have been 
considered but are moot in view of the new ground(s) of rejection. 

Applicant(s) seem to be asserting somehow selected data to be audited 
somehow includes not selected data and therefore all data in inherently audited. The 
applicant(s) also seem to be asserting that because the invention allows for selection or 
de-selection via a user interface (i.e. window or browser) that somehow this is a novel 
feature of the invention. One of ordinary skill in the art would conclude that when a prior 



Application/Control Number: 09/963,292 Page 14 

Art Unit: 2155 

art teaches a selection of a particular data to be audited, such prior art means of 
selection /de-selection would also incorporate well-known prior art methods of selection 
such as checking a box, highlighting, pull-down menu (see Kao: col. 6, line 57), ect. To 
expedite prosecution, the applicant(s) are suggested to clearly and explicitly recite the 
functional limitations of the system rather than relying on the method of use or 
subjective limitations. 

Conclusion 

6. For the reasons above, claims 1-16, 18-36, 38, and 39 have been rejected and 
remain pending. 

7. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to MICHAEL Y. WON whose telephone number is 
(571)272-3993. The examiner can normally be reached on M-Th: 10AM-8PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Saleh Najjar can be reached on 571-272-4006. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a 
USPTO Customer Service Representative or access to the automated information 
system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 



/Michael Won/ 
Primary Examiner 
April 25, 2008 



